How to Fetch a Moving Target with Poudriere

The FreeBSD ports framework has a simple idea about the world: a distfile never changes.
It has a fixed size and a fixed checksum, written once into distinfo and verified every time after that.
It is super useful to verify that the upstream has not changed the package, or that someone changed it without authorization.
Basically this is the trust contract between our FreeBSD ports system and the upstream ports.
My problem is that one of my distfiles has to change - almost every build.